First Commit

customers.php

@@ -0,0 +1,439 @@
+<?php
+require_once("include/globals.php");
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   header("Location: /");
+   exit();
+}
+
+
+//
+// Process all actions to manage the customers for a user account
+//
+$CurrentTable = "people";
+$DeleteField  = "first_name,last_name";
+$dSeparator   = " ";
+$FormFile     = "customers.form.php";
+$TitleText    = getLanguageText('TEXT-CUSTOMERS');
+$OrderBy      = "last_name,first_name";
+
+// Start the template and output buffering
+startTemplate();
+$templatePageTitle = "$TitleText";
+
+
+$naction = "";
+if (array_key_exists('naction',$_GET)) $naction = $_GET['naction'];
+if (array_key_exists('naction',$_POST)) $naction = $_POST['naction'];
+
+if ($naction == "" && $_SESSION['UserInfo']['type'] == 'Parent') $naction = 'display';
+
+$mode = "";
+if (array_key_exists('mode',$_GET)) $mode = db_escape_string($_GET['mode']);
+if (array_key_exists('mode',$_POST)) $mode = db_escape_string($_POST['mode']);
+$_SESSION['mode'] = $mode;
+
+
+$next_action = "";
+if (array_key_exists('next_action',$_GET)) $next_action = $_GET['next_action'];
+if (array_key_exists('next_action',$_POST)) $next_action = $_POST['next_action'];
+
+unset($override_naction);
+if (array_key_exists('override_naction',$_GET)) $override_naction = $_GET['override_naction'];
+if (array_key_exists('override_naction',$_POST)) $override_naction = $_POST['override_naction'];
+
+unset($donext);
+if (array_key_exists('donext',$_GET)) $donext = $_GET['donext'];
+if (array_key_exists('donext',$_POST)) $donext = $_POST['donext'];
+
+if (isset($donext)) $naction = $donext;
+
+
+
+// Set school_num from global array
+$school_num = $school_record['record_num'];
+
+
+// Ensure that only valid user types see the menu
+$AllowedUserTypes = array('SuperUser','System Administrator','Application Administrator','Communications Administrator','Administration Team','Schedule Team');
+if (checkPermission($AllowedUserTypes) == 1 && $_SESSION['mode'] != 'parent') {
+   include "customers.options.php";
+}
+
+
+
+switch (strtolower($naction)) {
+   case "add":
+      $next_naction = "insert";
+      $active = 'Y';
+      $display = 'Y';
+
+      include $FormFile;
+      break;
+
+   case "insert":
+      extract($_POST);
+
+      $first_name = trim($first_name);
+      $last_name = trim($last_name);
+      if (!isset($selected_user_num)) $selected_user_num = 0;
+      $user_num = $selected_user_num;
+
+      if (strlen(trim($first_name)) == 0 || strlen(trim($last_name)) == 0) {
+         $error_message = getLanguageText('ERRORMSG-FIRST-LAST-NAME-REQUIRED');
+         $_POST['naction'] = 'add';
+         $args = encodeArray($_POST);
+         $args .= "&error_message=" . urlencode($error_message);
+         header("Location: /?$args");
+         exit();
+      }
+
+      if ($_SESSION['UserInfo']['type'] == 'Parent' || $_SESSION['UserInfo']['type'] == 'Staff' || $$_SESSION['UserInfo']['type'] == 'Guest') {
+         $user_num = intval($_SESSION['UserInfo']['record_num']);
+      }
+      else {
+         // Check that there is a user_num
+         if ($user_num == 0 || strlen($user_num) == 0) {
+            $error_message = getLanguageText('ERRORMSG-NO-ACCOUNT');
+            $_POST['naction'] = 'add';
+            $args = encodeArray($_POST);
+            $args .= "&error_message=" . urlencode($error_message);
+            header("Location: /?$args");
+            exit();
+         }
+
+         $user_num = intval($user_num);
+         $user_type = db_getVal("SELECT type FROM users WHERE school_num = $base_school_num AND record_num = $user_num");
+         if (!$user_type) {
+            $error_message = getLanguageText('ERRORMSG-INVALID-ACCOUNT');
+            $_POST['naction'] = 'add';
+            $args = encodeArray($_POST);
+            $args .= "&error_message=" . urlencode($error_message);
+            header("Location: /?$args");
+            exit();
+         }
+
+         if (!in_array($user_type,array('Parent','Administration Team','Schedule Team'))) {
+            $error_message = getLanguageText('ERRORMSG-INVALID-ACCOUNT');
+            $_POST['naction'] = 'add';
+            $args = encodeArray($_POST);
+            $args .= "&error_message=" . urlencode($error_message);
+            header("Location: /?$args");
+            exit();
+         }
+      }
+
+      $class_num = 1;
+      $status = 'Verified';
+      $added_date = date("Y-m-d",time());
+      $people_type = 'Customer';
+      $display = 'N';
+
+      // Reformat the name if required
+      if ($first_name == strtolower($first_name) || $first_name == strtoupper($first_name) ||
+               $last_name == strtolower($last_name) || $last_name == strtoupper($last_name)) {
+         $first_name = ucwords(strtolower($first_name));
+         $last_name = ucwords(strtolower($last_name));
+      }
+
+
+      // Save the customer
+      $school_num = $base_school_num;
+      if (!isset($menu_price_category) || strlen($menu_price_category) == 0) $menu_price_category = 'Regular';
+
+      $table = new Table("$CurrentTable");
+      $query = $table->BuildInsert();
+      db_query($query);
+      $record_num = db_insert_id();
+
+      $school_num = $school_record['record_num'];
+
+      $next_naction = 'search';
+
+      if ($_SESSION['UserInfo']['type'] == 'Parent') $next_naction = 'display';
+
+      $form_message = getLanguageText('RECORD-INSERTED-MSG');
+      header("Location: /?action=$action&naction=$next_naction&mode=$mode&form_message=" . urlencode($form_message) . "&error_message=" . urlencode($error_message));
+      exit();
+
+   case "edit":
+      $next_naction = "update";
+
+      // Get current record
+      $record_num = intval($_GET['record_num']);
+      $uwhere = "";
+      if (!in_array($_SESSION['UserInfo']['type'],array('Parent','Staff','Guest'))) {
+         $uwhere = "and user_num = " . $_SESSION['UserInfo']['record_num'] . " ";
+      }
+
+      $query = "select * from $CurrentTable " .
+               "where school_num = $base_school_num " .
+               $uwhere .
+               "and record_num = $record_num";
+      $results = db_query($query);
+      if (db_num_rows($results) == 1) {
+         $row = db_fetch_array($results);
+         extract($row);
+         include $FormFile;
+      }
+      else {
+         $error_message = getLanguageText('ERRORMSG-NOT-FOUND');
+         include $FormFile;
+      }
+      break;
+
+   case "update":
+      extract($_POST);
+
+      $first_name = trim($first_name);
+      $last_name = trim($last_name);
+      $user_num = $selected_user_num;
+
+      if (strlen(trim($first_name)) == 0 || strlen(trim($last_name)) == 0) {
+         $error_message = getLanguageText('ERRORMSG-FIRST-LAST-NAME-REQUIRED');
+         $_POST['naction'] = 'add';
+         $args = encodeArray($_POST);
+         $args .= "&error_message=" . urlencode($error_message);
+         header("Location: /?$args");
+         exit();
+      }
+
+      // Verify the form data
+      $numClasses = db_getVal("SELECT count(*) FROM classes WHERE school_num = $base_school_num");
+      if ($numClasses > 0 && ($class_num == 0 || strlen($class_num) == 0)) {
+         $error_message = getLanguageText('ERRORMSG-NO-CLASS');
+         $_POST['naction'] = 'edit';
+         $args = encodeArray($_POST);
+         $args .= "&error_message=" . urlencode($error_message);
+         header("Location: /?$args");
+         exit();
+      }
+
+      if ($_SESSION['UserInfo']['type'] == 'Parent') {
+         $user_num = intval($_SESSION['UserInfo']['record_num']);
+      }
+      else {
+         // Check that there is a user_num
+         if ($user_num == 0 || strlen($user_num) == 0) {
+            $error_message = getLanguageText('ERRORMSG-NO-ACCOUNT');
+            $_POST['naction'] = 'add';
+            $args = encodeArray($_POST);
+            $args .= "&error_message=" . urlencode($error_message);
+            header("Location: /?$args");
+            exit();
+         }
+
+         $user_num = intval($user_num);
+         $user_type = db_getVal("SELECT type FROM users WHERE school_num = $base_school_num AND record_num = $user_num");
+         if (!$user_type) {
+            $error_message = getLanguageText('ERRORMSG-INVALID-ACCOUNT');
+            $_POST['naction'] = 'add';
+            $args = encodeArray($_POST);
+            $args .= "&error_message=" . urlencode($error_message);
+            header("Location: /?$args");
+            exit();
+         }
+
+         if (!in_array($user_type,array('Parent','Administration Team','Staff','Guest'))) {
+            $error_message = getLanguageText('ERRORMSG-INVALID-ACCOUNT');
+            $_POST['naction'] = 'add';
+            $args = encodeArray($_POST);
+            $args .= "&error_message=" . urlencode($error_message);
+            header("Location: /?$args");
+            exit();
+         }
+      }
+
+
+      $uid = $user_num;
+
+      // Get original user_num
+      $record_num = intval($record_num);
+      $orig_user_num = db_getVal("SELECT user_num FROM people WHERE record_num = $record_num");
+
+      // Reformat first name if required
+      if ($first_name == strtolower($first_name) || $first_name == strtoupper($first_name)) {
+         $first_name = ucwords(strtolower($first_name));
+      }
+
+      // Reformat last name if required
+      if ($last_name == strtolower($last_name) || $last_name == strtoupper($last_name)) {
+         $last_name = ucwords(strtolower($last_name));
+
+         if (strpos($last_name,"Mc") !== false) {
+            $last_name[2] = $entered_last_name[2];
+         }
+         if (strpos($last_name,"Mac")) {
+            $last_name[3] = $entered_last_name[3];
+         }
+      }
+
+      // Update the record
+      $people_type = 'Customer';
+      $class_num = 1;
+      $school_num = $base_school_num;
+
+      $table = new Table("$CurrentTable");
+      $query = $table->BuildUpdate();
+      db_query($query);
+
+      $school_num = $school_record['record_num'];
+
+      // If the user_num was changed then move any order transactions to the new user_num
+      if ($user_num != $orig_user_num) {
+         db_query("UPDATE user_account SET user_num = $user_num WHERE people_num = $record_num");
+      }
+
+      if (isset($override_naction)) $naction = $override_naction;
+
+      $next_naction = 'search';
+
+      $form_message = getLanguageText('RECORD-UPDATED-MSG');
+      header("Location: /?action=$action&naction=$next_naction&mode=$mode&form_message=" . urlencode($form_message));
+      exit();
+
+   case "customer-lookup":
+      include "customer.lookup.php";
+      break;
+
+   case "show-info":
+      include "customer.info.php";
+      break;
+
+   case "delete-confirmed":
+      extract($_GET);
+      $record_num = intval($record_num);
+      $customer_num = $record_num;
+
+      $uwhere = "";
+      if ($_SESSION['UserInfo']['type'] == 'Parent' || $_SESSION['mode'] == 'parent') {
+         $uwhere = "and user_num = " . $_SESSION['UserInfo']['record_num'] . " ";
+      }
+
+      $query = "select * from $CurrentTable " .
+               "where school_num = $base_school_num " .
+               $uwhere .
+               "and record_num = $customer_num";
+      $results = db_query($query);
+      $numCustomers = db_num_rows($results);
+
+      // Check if this customer exists
+      if ($numCustomers != 1) {
+         $error_message = getLanguageText('ERRORMSG-NOT-FOUND');
+         header("Location: /?action=$action&naction=display&show_status=$show_status&show_type=$show_type&uid=$uid&mode=$mode&error_message=" . urlencode($error_message));
+         exit();
+      }
+
+      $row = db_fetch_array($results);
+      extract($row);
+      $snums = $school_record['linked_sites'];
+      $numOrders = db_getVal("SELECT count(*) FROM hotlunch_order_header WHERE school_num IN ($snums) AND ordered_by_num = $customer_num AND status IN ('Unpaid','Pending','Paid','Complimentary')");
+
+      if ($numOrders > 0) {
+         $error_message = getLanguageText('ERRORMSG-NO-DELETE-ORDERS');
+         header("Location: /?action=$action&naction=display&show_status=$show_status&show_type=$show_type&uid=$uid&mode=$mode&error_message=" . urlencode($error_message));
+         exit();
+      }
+
+      // Delete the current record
+      $query = "delete from $CurrentTable where school_num = $base_school_num and record_num = $record_num";
+      db_query($query);
+
+      // Delete any orders
+      $query = "delete from hotlunch_order_header where school_num = $school_num and ordered_by_num = $record_num";
+      db_query($query);
+
+      $query = "delete from hotlunch_order_items where school_num = $school_num and ordered_by_num = $record_num";
+      db_query($query);
+
+      // Delete any allergies entries
+      db_query("DELETE FROM allergies WHERE school_num = $base_school_num AND people_num = $record_num");
+
+      // Delete user account entries
+      $query = "delete from user_account where school_num = $base_school_num and people_num = $record_num";
+      db_query($query);
+
+      // Update user balance_owing
+      updateUserBalance($user_num,$school_num);
+
+
+      $form_message = getLanguageText('RECORD-DELETED-MSG');
+
+      $next_naction = 'search';
+      header("Location: /?action=$action&naction=$next_naction&mode=$mode&form_message=" . urlencode($form_message));
+      exit();
+
+   case "search":
+   default:
+      if ($_SESSION['UserInfo']['type'] == 'Parent') {
+         include 'customer.display.php';
+         break;
+      }
+
+      // Lookup Form
+      include "customer.lookup.php";
+
+      $ChoosePagination = 'Y';
+      $next_naction = "lookup";
+
+      include $FormFile;
+      break;
+
+   case "lookup":
+      extract($_POST);
+      $user_num = intval($selected_user_num);
+      $table = new Table("$CurrentTable");
+      $lookup_query = $table->BuildQuery("","","st.");
+      $lookup_where = "";
+      if (stripos("where ",$lookup_query)) $lookup_where = preg_replace("/.* where/i","and",$lookup_query);
+      if (stripos("order by ",$lookup_where)) $lookup_where = preg_replace("/order by .*/i","",$lookup_where);
+      $lookup_where .= " ";
+      $naction = "list";
+      $TitleText = getLanguageText('RECORD-LOOKUP');
+      if (isset($user_num) && $user_num > 0) {
+         $query = "select * from users where record_num = $user_num";
+         $results = db_query($query);
+         $row = db_fetch_array($results);
+         $userid = $row['userid'];
+         $name = $row['first_name'] . ' ' . $row['last_name'];
+         $PageTitle = getLanguageText('TEXT-CUSTOMER-ACCOUNT-LIST') . "<br> $name ($userid)";
+      }
+
+      include 'customer.display.php';
+      break;
+
+   case "fetch":
+      if ($_SESSION['UserInfo']['type'] == 'Parent') {
+         include 'customer.display.php';
+         break;
+      }
+
+      $lookup_where = "where school.record_num = $record_num";
+      $naction = "list";
+      $TitleText = getLanguageText('RECORD-LOOKUP');
+      break;
+
+   case "display":
+   case "list":
+      include 'customer.display.php';
+      break;
+}
+
+
+//
+// Display search screen if required
+//
+if ($naction == 'lookup') {
+   // Lookup Form
+   include "customer.lookup.php";
+
+   $ChoosePagination = 'Y';
+   $next_naction = "lookup";
+
+   include $FormFile;
+}
+
+
+endTemplate();
+
+?>